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We consider the problem of encoding classical information into unknown qudit states belonging to 
any basis, of a maximal set of mutually unbiased bases, by one party and then decoding by another 
party who has perfect knowledge of the basis. Working with qudits of prime dimensions, we point 
out a no-go theorem that forbids 'shift' operations on arbitrary unknown states. We then provide 
the necessary conditions for reliable encoding/decoding. 
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I. INTRODUCTION 



o 

The idea of encoding and decoding classical information onto an unknown quantum state is essentially related to 
(T) \ transformations and measurements of vectors state in a Hilbert space. 

Suppose that Bob picks a qudit state from a given set (a subset of a d-dimensional Hilbert space Tid) and sends it 
to Alice who is oblivious about the state. Alice is then expected to encode classical information (one out of d symbols) 
by virtue of unitary transformations before sending it back to Bob who should decode by gaining full information. 
This task can be reliably accomplished once the initial set of states forms a basis of Tid- In fact, in such a case, Alice 
has simply to shift the incoming state into another of the basis by an amount determined by the symbol she wants to 
encode, while Bob has to measure in (project onto) the basis to retrieve Alice operation-symbol. 

What happen if the initial set of states comprises more than one basis, specifically a number of mutually unbiased 
!>■ ■ bases (MUB) 0,0]? 

This problem is of fundamental interest in quantum cryptography. For instance, blind encoding of classical infor- 
mation into states belonging to MUB is used in two-way deterministic quantum key distribution 0, 0, M, H 0] • A 
Q_i! crucial point to note in these protocols is that security results from the ambiguity of bases introduced by MUB. The 
endeavor for a more secure protocol thus entails the problem of maximizing the number of MUB over which encoding 
£h ' operations perform equally and decoding may be done reliably. 

The maximum cardinality of any set of MUB in Tid is exactly known to be d + 1 only when d is a prime power [l|, 0] • 
If, moreover, it is simply prime, a straightforward construction of bases states exist [3, 0. We henceforth restrict our 
attention to qudits of prime dimensions. 

Unfortunately, a nontrivial scenario already emerges for qubits (d = 2), where the non existence of the universal- 
NOT [1, IH forbids the ability to shift (flip) arbitrary unknown qubit states while the unitary Pauli operators shift 
qubits in only two out of three MUB. 

This entails two main problems that we shall deal with in this paper: i) Can Alice blindly encode onto an unknown 
state of any basis of a maximal set of MUB? ii) Can Bob efficiently decode the full information? We discuss the first 
in terms of a No-Go Theorem [?J which forbids the shifting of one arbitrary pure state into another in Sec. II, and we 
address the second problem in Sec. Ill by devising a specific protocol. In order to quantify the figure of merit of this 
protocol we consider, in Sec. IV, its efficiency within a communication framework [lfj. We then apply the protocol to 
some examples. We reserve Sec.V for conclusions. 



II. THE NO-GO THEOREM 



We start by considering a d-dimensional quantum system, i.e., a qudit. In its Hilbert space Ti.d we choose a basis 
(computational basis) {\j)} labeled by elements j G Z^. Moving from the d = 2 case (qubit), we can introduce 
generalized Pauli operators X and Z such that 



X\j) = \j+1), (1) 
Z\j)=uS\j), (2) 
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with 

uj := exp (i-jj ■ ( 3 ) 

Generalized Pauli operators are unitary and satisfy the anticommutation relation 

ZX = ujXZ. (4) 

It is well known [H, Q that in 7id, with d prime number, there are d+1 MUB and their states can be constructed 
as eigenstates of operators 

XZ°, XZ 1 , XZ 2 , XZ 4 ' 1 , Z. (5) 

Now suppose that Bob picks one of these states, say \ijjt) where t = 0, 1, . . . , d — 1 denotes the element within a basis 
and k = 0, 1, . . . , d denotes the basis. Bob sends the state to Alice who is oblivious about it and she wants to encode 
one of the symbols belonging to the alphabet A = {0, 1, . . . , d — 1}. She therefore requires a unitary shift operator U 
such that 

l#> ^ IV4r>> (6) 

where © stands for the sum mod d. 

However, in considering a unitary operation that may shift qudit states in any MUB, we arrive at the following 
theorem (generalizing the one for qutrit [?J and extending the arguments for the nonexistence of Universal-NOT [1,0]). 

Theorem 1 There is no unitary transformation that may shift between pure orthogonal states of any MUB of prime 
dimension. 

Proof. We prove the theorem by reductio ad absurdum. Let us first consider the eigenvectors of operators XZ k , 
k — 0, 1..., d — 1 denoting d different MUB, thus excluding the computational basis. They can be written as 

d-1 

where s 3 ; = j + ... + d — 1. We then assume the existence of a unitary transformation U acting on the computational 
basis as 

U{\0) , |1> , |d - 1)} -> {a |1> , ai |2) , a^ |0», (8) 

with ai G C such that \ai\ — 1 and i — 0, l...,d— 1. 

Without loss of generality, we may single out a state K/'t) with index T for any k (basis) and consider the operator 
U acting on it 

1 d-1 

U\ife) = -=Y, a ^ T{d ~ 3) - kS] \J + !> ■ (9) 

V d j=0 

Then, for any k, the resulting vector should correspond to one of the other vectors of the basis (orthogonal to the 
initial state) and we may write 

^a/^'^ |i + l) = -^|>^)-^ (10) 
j=o v j=0 

with t ^ T as necessary shift requirement. By equating the coefficients of the same states at both sides of Eq. (fT0)) . 
we get 

aj=u t(.d-i-i)-nd-j)+kj 4 

Taking two indexes j and j' = j — i differing by an integer i, we have 

^ =LU (T + k- t)l ^ (12) 

a f 
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and for i = 1 



*-= U -W r ) (13) 



a j+1 

which must be invariant with respect to k. Since t could be different for differing ks, we require 



,-t fc +*+T _ ,.,-v+*'+T y k jL k >. ( 14 ) 



For every term x = k — tk, we may find a particular fc' such that 

fc' = (a; + T)mod(d-l), (15) 

thus 

1 = W -V+T (17 ) 

T = tfc,. (18) 
The last equality contradicts the shift requirement T ^ tk, Vfc. This completes the proof. ■ 

III. REQUIREMENTS FOR RELIABLE ENCODING/ DECODING 

Given the result of theorem [1] together with the fact that a unitary operator of the form XZ l may shift eigenvectors 
of XZ k when k ^ I (that is states in a number of d MUB) [2|, we also have the following corollary. 

Corollary 2 A unitary operation may shift a audit state to an orthogonal one in at most d MUB. 

This results in the impossibility for Alice to reliably encode on d + 1 MUB. An obvious example would see Bob 
sending a state which is the eigenvector of XZ k and Alice cannot encode a shift unless she knows the basis Bob 
used, that is k (then she may use XZ l , k I). Bob on the other hand could not perfectly decode, since in the event 
he measured a shifted state he could not discern between the d different kinds of transformations that would have 
resulted in the same evolution. However, Bob may be able to lessen his uncertainty by sending more qudits of differing 
bases and in the case that Bob may deduce perfectly Alice's unitary transformation, the problems of both encoding 
and decoding are solved. We therefore propose the following lemma. 

Lemma 3 A reliably blind encoding with d + 1 MUB needs to use strings of d qudits from d differing MUB. 

Proof. Let us denote the unitary transformation to shift a state in any basis except fcth as U-r. The number of unitaries 
available to shift a qudit state (including identity) would be d + 2. These are the unitaries Ui, i — 1, . . . , d + 1, of 
Eq.© plus identity operation (say Ud+2)- Bob's initial uncertainty about unitary transformation U amounts to 

H (U) = log (d + 2) . (19) 

where H stands for the Shannon entropy. Thus, the maximum information I max that Bob may gain is exactly given 
byEq-HS]). 

Suppose that Bob prepares a qudit state and that it undergoes Alice's unitary Ui. All Ui, i = 1, . . . , d + 2, are 
equally probable, thus 

Pr ^ = dT~2- (20) 

Bob's subsequent measurement reveals whether the shift has taken place or not. The latter happens when the unitary 
is either U-^ or Ud+2 (identity). Thus, we have the following probabilities 

Pr(* = 0) = -J^, (21) 
Pr( S =l) = ^ (22) 
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with S is a binary random variable taking values to denote shift of the state (s = no shift, s = 1 shift). Moreover, 

\ i = k,d + 2 
i ^ k, d + 2 ' 



Pr (77 = Ui | s = 0) = ' 2 



Pr (U = U t | « = 1) = 



i = k,d + 2 



i i ^ fc,d + 2 ' 

Then, Bob's uncertainty (about U) subsequent to his measurement can be calculated by using 

H (U \S = s) = -^Pr(Ui \ S = s) log [Pr (U t \S = s)], 

i 

so that Bob's a posteriori uncertainty results 

H post (U) = ^ Pr (S = s) H (U t \S = s) 



(23) 
(24) 



(25) 



d+2 



-log- 



d+2 



-log 



By using Eas.l[T9]) and (|2^|) we get 



H (U) - H post (U) < I„ 



(26) 
(27) 



If Bob had used two qudits of differing basis, k and k', with the encoding operation acting on both of them, we have 
to distinguish among four values of s with probabilities 



Moreover, 



Pr(s = 00) = 

Pr(s = 01) = 

Pr (s = 10) = 

Pr(s = 11) = 

Pr (U = Ui | s = 00) = 
Pr(U = Ui | s = 01) 
Pr (U = Ui | s = 10) = 



1 


d + 


2 


1 




d + 


2' 


1 




d + 


2' 


d- 


1 


d + 


2' 



Pr(U = Ui\s = 11) = 
then Bob's a posteriori uncertainty becomes 







1 i=d+2 
i^d+2 ' 

1 % = 

i^fc ' 

1 i = F 

i^fc ' 

i= fc,F,d + 2 
i^fc,F,d + 2 



^ post (^) = j-^ log (d - 1) • 

Equation (156")) can straightforwardly be generalized to strings of n + 1 qudits (with n + 3 possible s values) as 

d — n 



H P ost (U) 



d + 2 



log (d - n) 



(28) 
(29) 
(30) 
(31) 

(32) 
(33) 
(34) 
(35) 

(36) 

(37) 



It is easy to see that the uncertainty becomes 0, when d — n — 1, or when n = d — 1. Hence in order for Bob to have 
complete information on the unitary transformation used, the number of qudits sent must be at least equal to d. ■ 
It is worth noting that the problem of encoding is consequently solved as well. 
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IV. EFFICIENCY OF THE PROTOCOL 



Despite the fact that Alice and Bob may communicate reliably as described above, the protocol is far from being 
efficient. Let us consider the definition of efficiency for blind encoding in the framework of communication. This 
definition closely follows the work of Ref. [10( • It is well known that given a quantum system the maximally attainable 
classical information / (in independent measurements) is bounded by the Holevo bound [ll| 

I<S(p)-Y,Pi s (Pi)- (38) 

i 

Since each qudit sent and received by Bob may perfectly be distinguished by Bob (as the states represent pure 
orthogonal states), he saturates the Holevo bound thus achieving, with d qudits, the maximal information d\og 2 d 
bits. However, given a protocol, the actual amount of information that may be shared between Alice and Bob may 
differ from this maximal value. If we consider the shared information between Alice and Bob in the previous section, 
an ideal channel would have allowed its classical capacity [ll| to be 

C := max/ (A : B) = - log f -^—] . (39) 



J + 2 . 

Defining efficiency to be the ratio of the perfect channel capacity to the maximal information of d qudits, we get 

log 2 (d + 2 



d\og 2 d 



< 1, (40) 



with equality only in the case for qubits (d — 2). The ratio decreases by increasing d. In order to achieve unit 
efficiency we must force the numerator to be dlog 2 d or we must allow Alice to use d d unitary operations. Intuitively 
this may be understood as follows: since d qudits are sent back and forth between Bob and Alice, the exhaustive 
number of codewords that may be shared between them would be d d . Therefore, Alice must be able to execute d d 
unitary operations for encoding while Bob must perfectly decode them. This means that Alice must construct unique 
operations that the composite system of d qudits (of differing MUB) could actually discern. 
We consider the composed system state of d qudits 

( 41 ) 



where the ip % belongs to d different MUB. Vectors like (|4T|) span the space of d d independent vectors. Then the 
encoding problem can be recast into the following form: can we find an encoding operation on such that \ip l tl ) 
gets shifted to | ip l t[(Sa ) for any integers U e [1, d] and a £ [0, d — 1]? The answer to this question is positive. 

Let us first define the operation E/^+j as the operation that does not shift the state of the (d + l)th basis (which is 
not part of the composite system |\&)) but would shift the states of all other qudits by 1. If we wish to encode a value 
a on a particular qudit i, we need to ensure that while qudit i gets shifted by a, the others would not be affected 
by the shift. Hence we could operate on the system |\&) the operations U d ~ a U-^-j which shifts the qudit i by a and 
the others by (d — a + a) mode? = 0. It is straightforward to see that we could execute a similar recipe to any other 
qudits in \^>). Hence, a general encoding may be written as 

(ut aU Wl) ( U t bU Wl) ■ ■ ■ ( U t kU Wl) \« ■ ■<) - ( 42 ) 

where a,b,...,k are different values to encode onto the relevant qudits. Simple observation tells us that we may 
encode in such a way all the d d codewords. 

The remaining question is whether such a combination is unique; i.e. despite the possible combinations for a string 
(subject to the condition that no two qudits in the string share a basis), one set of operations results in only one unique 
evolution of a string of states. This is vital as a set of operations must be recognizable by such strings of qudits. Let 
us write Eq. p2")) as — > |$) and suppose that another operation B gives B\^) — > |$) then it obviously follows 
A = B. It goes without saying that other strings do not yield the same result as that of As long as Alice and 
Bob agrees to codewords to be designated to each set of operations, they may then have a faithful encoding/decoding 
procedure which is of unit efficiency. This is important since the above construction of encoding operations is done 
in states of known bases, while Alice needs to use these operations on unknown strings of qudits. 
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A. The Qubit Case 



Consider Bob preparing two qubits states |t/'t 1 <8> ipt 2 ) w ith ki^), \i J t 2 ) eigenstates of Pauli operator X and Y = XZ 
respectively. In constructing an operation which may flip the states of both qubits, Alice makes use of Eq. (l42p 

(ut a U§U^ b Ui) |< ® O -> ® V- t 2 2ffi6 ) , (43) 

with a, be [0, 1]. 

We can readily convince ourselves of the above by noticing 

(Ul- a U§) =X 2 - a Z a , (44) 
Ul- b U^j =Y 2 - b Z b . (45) 



B. The Qutrit Case 



Consider Bob preparing three qutrits states \tpi ® ip2 ® ^3) with the integer indices denoting different MUB. 
constructing operations which may flip the states of qutrits, Alice makes use of Eq. (|4"!?|) 



In 



(V|- Q c/f) (u§- b ui) (u§- c u*)] m 1< ® # a ®<) 

~* l^tieo) l^eb) |^t 3 ec) i 



(46) 



with a,6,c e [0, 1,2]. 

The unitary operations £/j corresponds to the well known shift/error operators for qutrits [Hj]. A table for the 
explicit evolution of the various possible states Bob may prepare under Alice's transformation is referred to in 0]. 



V. CONCLUSION 



We have considered the problem of blind encoding classical information into quantum states belonging to a maximal 
set of MUB for systems whose dimensions equal to a prime number d. We noted that trivial encoding is essentially 
forbidden due to the inability of reliably shifting an unknown arbitrary qudit by unitary operations. We proved this 
in a no-go theorem which is a generalisation of specific case treated in Ref. [?J • On the other hand, Bob cannot reliably 
decode the information content of a qudit unless he actually prepares and then measures a string of d qudits. We 
provided a simple information theoretic proof for this lemma. 

We then noticed that while d is the minimum number of qudits that must be sent to Alice for reliable decoding, the 
available generalised Pauli operations do not provide an efficient encoding protocol. Unit efficiency may be achieved 
with the protocol we proposed for the relevant encoding and decoding procedure. Two examples of application of this 
protocol has been explicitly shown. 

The developed approach paves the way for further studies of two way quantum communication with channels of 
generic dimension and may be useful for cryptographic tasks. 
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